mmu_oea.c revision 159324
1/*-
2 * Copyright (c) 2001 The NetBSD Foundation, Inc.
3 * All rights reserved.
4 *
5 * This code is derived from software contributed to The NetBSD Foundation
6 * by Matt Thomas <matt@3am-software.com> of Allegro Networks, Inc.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 3. All advertising materials mentioning features or use of this software
17 *    must display the following acknowledgement:
18 *        This product includes software developed by the NetBSD
19 *        Foundation, Inc. and its contributors.
20 * 4. Neither the name of The NetBSD Foundation nor the names of its
21 *    contributors may be used to endorse or promote products derived
22 *    from this software without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
25 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
26 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
27 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
28 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34 * POSSIBILITY OF SUCH DAMAGE.
35 */
36/*-
37 * Copyright (C) 1995, 1996 Wolfgang Solfrank.
38 * Copyright (C) 1995, 1996 TooLs GmbH.
39 * All rights reserved.
40 *
41 * Redistribution and use in source and binary forms, with or without
42 * modification, are permitted provided that the following conditions
43 * are met:
44 * 1. Redistributions of source code must retain the above copyright
45 *    notice, this list of conditions and the following disclaimer.
46 * 2. Redistributions in binary form must reproduce the above copyright
47 *    notice, this list of conditions and the following disclaimer in the
48 *    documentation and/or other materials provided with the distribution.
49 * 3. All advertising materials mentioning features or use of this software
50 *    must display the following acknowledgement:
51 *	This product includes software developed by TooLs GmbH.
52 * 4. The name of TooLs GmbH may not be used to endorse or promote products
53 *    derived from this software without specific prior written permission.
54 *
55 * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
56 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
57 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
58 * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
59 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
61 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
62 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
63 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
64 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * $NetBSD: pmap.c,v 1.28 2000/03/26 20:42:36 kleink Exp $
67 */
68/*-
69 * Copyright (C) 2001 Benno Rice.
70 * All rights reserved.
71 *
72 * Redistribution and use in source and binary forms, with or without
73 * modification, are permitted provided that the following conditions
74 * are met:
75 * 1. Redistributions of source code must retain the above copyright
76 *    notice, this list of conditions and the following disclaimer.
77 * 2. Redistributions in binary form must reproduce the above copyright
78 *    notice, this list of conditions and the following disclaimer in the
79 *    documentation and/or other materials provided with the distribution.
80 *
81 * THIS SOFTWARE IS PROVIDED BY Benno Rice ``AS IS'' AND ANY EXPRESS OR
82 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
83 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
84 * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
85 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
86 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
87 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
88 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
89 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
90 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
91 */
92
93#include <sys/cdefs.h>
94__FBSDID("$FreeBSD: head/sys/powerpc/aim/mmu_oea.c 159324 2006-06-06 02:02:10Z alc $");
95
96/*
97 * Manages physical address maps.
98 *
99 * In addition to hardware address maps, this module is called upon to
100 * provide software-use-only maps which may or may not be stored in the
101 * same form as hardware maps.  These pseudo-maps are used to store
102 * intermediate results from copy operations to and from address spaces.
103 *
104 * Since the information managed by this module is also stored by the
105 * logical address mapping module, this module may throw away valid virtual
106 * to physical mappings at almost any time.  However, invalidations of
107 * mappings must be done as requested.
108 *
109 * In order to cope with hardware architectures which make virtual to
110 * physical map invalidates expensive, this module may delay invalidate
111 * reduced protection operations until such time as they are actually
112 * necessary.  This module is given full information as to which processors
113 * are currently using which maps, and to when physical maps must be made
114 * correct.
115 */
116
117#include "opt_kstack_pages.h"
118
119#include <sys/param.h>
120#include <sys/kernel.h>
121#include <sys/ktr.h>
122#include <sys/lock.h>
123#include <sys/msgbuf.h>
124#include <sys/mutex.h>
125#include <sys/proc.h>
126#include <sys/sysctl.h>
127#include <sys/systm.h>
128#include <sys/vmmeter.h>
129
130#include <dev/ofw/openfirm.h>
131
132#include <vm/vm.h>
133#include <vm/vm_param.h>
134#include <vm/vm_kern.h>
135#include <vm/vm_page.h>
136#include <vm/vm_map.h>
137#include <vm/vm_object.h>
138#include <vm/vm_extern.h>
139#include <vm/vm_pageout.h>
140#include <vm/vm_pager.h>
141#include <vm/uma.h>
142
143#include <machine/cpu.h>
144#include <machine/powerpc.h>
145#include <machine/bat.h>
146#include <machine/frame.h>
147#include <machine/md_var.h>
148#include <machine/psl.h>
149#include <machine/pte.h>
150#include <machine/sr.h>
151#include <machine/mmuvar.h>
152
153#include "mmu_if.h"
154
155#define	MOEA_DEBUG
156
157#define TODO	panic("%s: not implemented", __func__);
158
159#define	TLBIE(va)	__asm __volatile("tlbie %0" :: "r"(va))
160#define	TLBSYNC()	__asm __volatile("tlbsync");
161#define	SYNC()		__asm __volatile("sync");
162#define	EIEIO()		__asm __volatile("eieio");
163
164#define	VSID_MAKE(sr, hash)	((sr) | (((hash) & 0xfffff) << 4))
165#define	VSID_TO_SR(vsid)	((vsid) & 0xf)
166#define	VSID_TO_HASH(vsid)	(((vsid) >> 4) & 0xfffff)
167
168#define	PVO_PTEGIDX_MASK	0x007		/* which PTEG slot */
169#define	PVO_PTEGIDX_VALID	0x008		/* slot is valid */
170#define	PVO_WIRED		0x010		/* PVO entry is wired */
171#define	PVO_MANAGED		0x020		/* PVO entry is managed */
172#define	PVO_EXECUTABLE		0x040		/* PVO entry is executable */
173#define	PVO_BOOTSTRAP		0x080		/* PVO entry allocated during
174						   bootstrap */
175#define PVO_FAKE		0x100		/* fictitious phys page */
176#define	PVO_VADDR(pvo)		((pvo)->pvo_vaddr & ~ADDR_POFF)
177#define	PVO_ISEXECUTABLE(pvo)	((pvo)->pvo_vaddr & PVO_EXECUTABLE)
178#define PVO_ISFAKE(pvo)		((pvo)->pvo_vaddr & PVO_FAKE)
179#define	PVO_PTEGIDX_GET(pvo)	((pvo)->pvo_vaddr & PVO_PTEGIDX_MASK)
180#define	PVO_PTEGIDX_ISSET(pvo)	((pvo)->pvo_vaddr & PVO_PTEGIDX_VALID)
181#define	PVO_PTEGIDX_CLR(pvo)	\
182	((void)((pvo)->pvo_vaddr &= ~(PVO_PTEGIDX_VALID|PVO_PTEGIDX_MASK)))
183#define	PVO_PTEGIDX_SET(pvo, i)	\
184	((void)((pvo)->pvo_vaddr |= (i)|PVO_PTEGIDX_VALID))
185
186#define	MOEA_PVO_CHECK(pvo)
187
188struct ofw_map {
189	vm_offset_t	om_va;
190	vm_size_t	om_len;
191	vm_offset_t	om_pa;
192	u_int		om_mode;
193};
194
195/*
196 * Map of physical memory regions.
197 */
198static struct	mem_region *regions;
199static struct	mem_region *pregions;
200u_int           phys_avail_count;
201int		regions_sz, pregions_sz;
202static struct	ofw_map *translations;
203
204extern struct pmap ofw_pmap;
205
206
207
208/*
209 * Lock for the pteg and pvo tables.
210 */
211struct mtx	moea_table_mutex;
212
213/*
214 * PTEG data.
215 */
216static struct	pteg *moea_pteg_table;
217u_int		moea_pteg_count;
218u_int		moea_pteg_mask;
219
220/*
221 * PVO data.
222 */
223struct	pvo_head *moea_pvo_table;		/* pvo entries by pteg index */
224struct	pvo_head moea_pvo_kunmanaged =
225    LIST_HEAD_INITIALIZER(moea_pvo_kunmanaged);	/* list of unmanaged pages */
226struct	pvo_head moea_pvo_unmanaged =
227    LIST_HEAD_INITIALIZER(moea_pvo_unmanaged);	/* list of unmanaged pages */
228
229uma_zone_t	moea_upvo_zone;	/* zone for pvo entries for unmanaged pages */
230uma_zone_t	moea_mpvo_zone;	/* zone for pvo entries for managed pages */
231
232#define	BPVO_POOL_SIZE	32768
233static struct	pvo_entry *moea_bpvo_pool;
234static int	moea_bpvo_pool_index = 0;
235
236#define	VSID_NBPW	(sizeof(u_int32_t) * 8)
237static u_int	moea_vsid_bitmap[NPMAPS / VSID_NBPW];
238
239static boolean_t moea_initialized = FALSE;
240
241/*
242 * Statistics.
243 */
244u_int	moea_pte_valid = 0;
245u_int	moea_pte_overflow = 0;
246u_int	moea_pte_replacements = 0;
247u_int	moea_pvo_entries = 0;
248u_int	moea_pvo_enter_calls = 0;
249u_int	moea_pvo_remove_calls = 0;
250u_int	moea_pte_spills = 0;
251SYSCTL_INT(_machdep, OID_AUTO, moea_pte_valid, CTLFLAG_RD, &moea_pte_valid,
252    0, "");
253SYSCTL_INT(_machdep, OID_AUTO, moea_pte_overflow, CTLFLAG_RD,
254    &moea_pte_overflow, 0, "");
255SYSCTL_INT(_machdep, OID_AUTO, moea_pte_replacements, CTLFLAG_RD,
256    &moea_pte_replacements, 0, "");
257SYSCTL_INT(_machdep, OID_AUTO, moea_pvo_entries, CTLFLAG_RD, &moea_pvo_entries,
258    0, "");
259SYSCTL_INT(_machdep, OID_AUTO, moea_pvo_enter_calls, CTLFLAG_RD,
260    &moea_pvo_enter_calls, 0, "");
261SYSCTL_INT(_machdep, OID_AUTO, moea_pvo_remove_calls, CTLFLAG_RD,
262    &moea_pvo_remove_calls, 0, "");
263SYSCTL_INT(_machdep, OID_AUTO, moea_pte_spills, CTLFLAG_RD,
264    &moea_pte_spills, 0, "");
265
266struct	pvo_entry *moea_pvo_zeropage;
267
268vm_offset_t	moea_rkva_start = VM_MIN_KERNEL_ADDRESS;
269u_int		moea_rkva_count = 4;
270
271/*
272 * Allocate physical memory for use in moea_bootstrap.
273 */
274static vm_offset_t	moea_bootstrap_alloc(vm_size_t, u_int);
275
276/*
277 * PTE calls.
278 */
279static int		moea_pte_insert(u_int, struct pte *);
280
281/*
282 * PVO calls.
283 */
284static int	moea_pvo_enter(pmap_t, uma_zone_t, struct pvo_head *,
285		    vm_offset_t, vm_offset_t, u_int, int);
286static void	moea_pvo_remove(struct pvo_entry *, int);
287static struct	pvo_entry *moea_pvo_find_va(pmap_t, vm_offset_t, int *);
288static struct	pte *moea_pvo_to_pte(const struct pvo_entry *, int);
289
290/*
291 * Utility routines.
292 */
293static void		moea_enter_locked(pmap_t, vm_offset_t, vm_page_t,
294			    vm_prot_t, boolean_t);
295static struct		pvo_entry *moea_rkva_alloc(mmu_t);
296static void		moea_pa_map(struct pvo_entry *, vm_offset_t,
297			    struct pte *, int *);
298static void		moea_pa_unmap(struct pvo_entry *, struct pte *, int *);
299static void		moea_syncicache(vm_offset_t, vm_size_t);
300static boolean_t	moea_query_bit(vm_page_t, int);
301static u_int		moea_clear_bit(vm_page_t, int, int *);
302static void		moea_kremove(mmu_t, vm_offset_t);
303static void		tlbia(void);
304int		moea_pte_spill(vm_offset_t);
305
306/*
307 * Kernel MMU interface
308 */
309void moea_change_wiring(mmu_t, pmap_t, vm_offset_t, boolean_t);
310void moea_clear_modify(mmu_t, vm_page_t);
311void moea_clear_reference(mmu_t, vm_page_t);
312void moea_copy_page(mmu_t, vm_page_t, vm_page_t);
313void moea_enter(mmu_t, pmap_t, vm_offset_t, vm_page_t, vm_prot_t, boolean_t);
314void moea_enter_object(mmu_t, pmap_t, vm_offset_t, vm_offset_t, vm_page_t,
315    vm_prot_t);
316vm_page_t moea_enter_quick(mmu_t, pmap_t, vm_offset_t, vm_page_t, vm_prot_t,
317    vm_page_t);
318vm_paddr_t moea_extract(mmu_t, pmap_t, vm_offset_t);
319vm_page_t moea_extract_and_hold(mmu_t, pmap_t, vm_offset_t, vm_prot_t);
320void moea_init(mmu_t);
321boolean_t moea_is_modified(mmu_t, vm_page_t);
322boolean_t moea_ts_referenced(mmu_t, vm_page_t);
323vm_offset_t moea_map(mmu_t, vm_offset_t *, vm_offset_t, vm_offset_t, int);
324boolean_t moea_page_exists_quick(mmu_t, pmap_t, vm_page_t);
325void moea_page_protect(mmu_t, vm_page_t, vm_prot_t);
326void moea_pinit(mmu_t, pmap_t);
327void moea_pinit0(mmu_t, pmap_t);
328void moea_protect(mmu_t, pmap_t, vm_offset_t, vm_offset_t, vm_prot_t);
329void moea_qenter(mmu_t, vm_offset_t, vm_page_t *, int);
330void moea_qremove(mmu_t, vm_offset_t, int);
331void moea_release(mmu_t, pmap_t);
332void moea_remove(mmu_t, pmap_t, vm_offset_t, vm_offset_t);
333void moea_remove_all(mmu_t, vm_page_t);
334void moea_zero_page(mmu_t, vm_page_t);
335void moea_zero_page_area(mmu_t, vm_page_t, int, int);
336void moea_zero_page_idle(mmu_t, vm_page_t);
337void moea_activate(mmu_t, struct thread *);
338void moea_deactivate(mmu_t, struct thread *);
339void moea_bootstrap(mmu_t, vm_offset_t, vm_offset_t);
340void *moea_mapdev(mmu_t, vm_offset_t, vm_size_t);
341void moea_unmapdev(mmu_t, vm_offset_t, vm_size_t);
342vm_offset_t moea_kextract(mmu_t, vm_offset_t);
343void moea_kenter(mmu_t, vm_offset_t, vm_offset_t);
344boolean_t moea_dev_direct_mapped(mmu_t, vm_offset_t, vm_size_t);
345
346static mmu_method_t moea_methods[] = {
347	MMUMETHOD(mmu_change_wiring,	moea_change_wiring),
348	MMUMETHOD(mmu_clear_modify,	moea_clear_modify),
349	MMUMETHOD(mmu_clear_reference,	moea_clear_reference),
350	MMUMETHOD(mmu_copy_page,	moea_copy_page),
351	MMUMETHOD(mmu_enter,		moea_enter),
352	MMUMETHOD(mmu_enter_object,	moea_enter_object),
353	MMUMETHOD(mmu_enter_quick,	moea_enter_quick),
354	MMUMETHOD(mmu_extract,		moea_extract),
355	MMUMETHOD(mmu_extract_and_hold,	moea_extract_and_hold),
356	MMUMETHOD(mmu_init,		moea_init),
357	MMUMETHOD(mmu_is_modified,	moea_is_modified),
358	MMUMETHOD(mmu_ts_referenced,	moea_ts_referenced),
359	MMUMETHOD(mmu_map,     		moea_map),
360	MMUMETHOD(mmu_page_exists_quick,moea_page_exists_quick),
361	MMUMETHOD(mmu_page_protect,    	moea_page_protect),
362	MMUMETHOD(mmu_pinit,		moea_pinit),
363	MMUMETHOD(mmu_pinit0,		moea_pinit0),
364	MMUMETHOD(mmu_protect,		moea_protect),
365	MMUMETHOD(mmu_qenter,		moea_qenter),
366	MMUMETHOD(mmu_qremove,		moea_qremove),
367	MMUMETHOD(mmu_release,		moea_release),
368	MMUMETHOD(mmu_remove,		moea_remove),
369	MMUMETHOD(mmu_remove_all,      	moea_remove_all),
370	MMUMETHOD(mmu_zero_page,       	moea_zero_page),
371	MMUMETHOD(mmu_zero_page_area,	moea_zero_page_area),
372	MMUMETHOD(mmu_zero_page_idle,	moea_zero_page_idle),
373	MMUMETHOD(mmu_activate,		moea_activate),
374	MMUMETHOD(mmu_deactivate,      	moea_deactivate),
375
376	/* Internal interfaces */
377	MMUMETHOD(mmu_bootstrap,       	moea_bootstrap),
378	MMUMETHOD(mmu_mapdev,		moea_mapdev),
379	MMUMETHOD(mmu_unmapdev,		moea_unmapdev),
380	MMUMETHOD(mmu_kextract,		moea_kextract),
381	MMUMETHOD(mmu_kenter,		moea_kenter),
382	MMUMETHOD(mmu_dev_direct_mapped,moea_dev_direct_mapped),
383
384	{ 0, 0 }
385};
386
387static mmu_def_t oea_mmu = {
388	MMU_TYPE_OEA,
389	moea_methods,
390	0
391};
392MMU_DEF(oea_mmu);
393
394
395static __inline int
396va_to_sr(u_int *sr, vm_offset_t va)
397{
398	return (sr[(uintptr_t)va >> ADDR_SR_SHFT]);
399}
400
401static __inline u_int
402va_to_pteg(u_int sr, vm_offset_t addr)
403{
404	u_int hash;
405
406	hash = (sr & SR_VSID_MASK) ^ (((u_int)addr & ADDR_PIDX) >>
407	    ADDR_PIDX_SHFT);
408	return (hash & moea_pteg_mask);
409}
410
411static __inline struct pvo_head *
412pa_to_pvoh(vm_offset_t pa, vm_page_t *pg_p)
413{
414	struct	vm_page *pg;
415
416	pg = PHYS_TO_VM_PAGE(pa);
417
418	if (pg_p != NULL)
419		*pg_p = pg;
420
421	if (pg == NULL)
422		return (&moea_pvo_unmanaged);
423
424	return (&pg->md.mdpg_pvoh);
425}
426
427static __inline struct pvo_head *
428vm_page_to_pvoh(vm_page_t m)
429{
430
431	return (&m->md.mdpg_pvoh);
432}
433
434static __inline void
435moea_attr_clear(vm_page_t m, int ptebit)
436{
437
438	m->md.mdpg_attrs &= ~ptebit;
439}
440
441static __inline int
442moea_attr_fetch(vm_page_t m)
443{
444
445	return (m->md.mdpg_attrs);
446}
447
448static __inline void
449moea_attr_save(vm_page_t m, int ptebit)
450{
451
452	m->md.mdpg_attrs |= ptebit;
453}
454
455static __inline int
456moea_pte_compare(const struct pte *pt, const struct pte *pvo_pt)
457{
458	if (pt->pte_hi == pvo_pt->pte_hi)
459		return (1);
460
461	return (0);
462}
463
464static __inline int
465moea_pte_match(struct pte *pt, u_int sr, vm_offset_t va, int which)
466{
467	return (pt->pte_hi & ~PTE_VALID) ==
468	    (((sr & SR_VSID_MASK) << PTE_VSID_SHFT) |
469	    ((va >> ADDR_API_SHFT) & PTE_API) | which);
470}
471
472static __inline void
473moea_pte_create(struct pte *pt, u_int sr, vm_offset_t va, u_int pte_lo)
474{
475	/*
476	 * Construct a PTE.  Default to IMB initially.  Valid bit only gets
477	 * set when the real pte is set in memory.
478	 *
479	 * Note: Don't set the valid bit for correct operation of tlb update.
480	 */
481	pt->pte_hi = ((sr & SR_VSID_MASK) << PTE_VSID_SHFT) |
482	    (((va & ADDR_PIDX) >> ADDR_API_SHFT) & PTE_API);
483	pt->pte_lo = pte_lo;
484}
485
486static __inline void
487moea_pte_synch(struct pte *pt, struct pte *pvo_pt)
488{
489
490	pvo_pt->pte_lo |= pt->pte_lo & (PTE_REF | PTE_CHG);
491}
492
493static __inline void
494moea_pte_clear(struct pte *pt, vm_offset_t va, int ptebit)
495{
496
497	/*
498	 * As shown in Section 7.6.3.2.3
499	 */
500	pt->pte_lo &= ~ptebit;
501	TLBIE(va);
502	EIEIO();
503	TLBSYNC();
504	SYNC();
505}
506
507static __inline void
508moea_pte_set(struct pte *pt, struct pte *pvo_pt)
509{
510
511	pvo_pt->pte_hi |= PTE_VALID;
512
513	/*
514	 * Update the PTE as defined in section 7.6.3.1.
515	 * Note that the REF/CHG bits are from pvo_pt and thus should havce
516	 * been saved so this routine can restore them (if desired).
517	 */
518	pt->pte_lo = pvo_pt->pte_lo;
519	EIEIO();
520	pt->pte_hi = pvo_pt->pte_hi;
521	SYNC();
522	moea_pte_valid++;
523}
524
525static __inline void
526moea_pte_unset(struct pte *pt, struct pte *pvo_pt, vm_offset_t va)
527{
528
529	pvo_pt->pte_hi &= ~PTE_VALID;
530
531	/*
532	 * Force the reg & chg bits back into the PTEs.
533	 */
534	SYNC();
535
536	/*
537	 * Invalidate the pte.
538	 */
539	pt->pte_hi &= ~PTE_VALID;
540
541	SYNC();
542	TLBIE(va);
543	EIEIO();
544	TLBSYNC();
545	SYNC();
546
547	/*
548	 * Save the reg & chg bits.
549	 */
550	moea_pte_synch(pt, pvo_pt);
551	moea_pte_valid--;
552}
553
554static __inline void
555moea_pte_change(struct pte *pt, struct pte *pvo_pt, vm_offset_t va)
556{
557
558	/*
559	 * Invalidate the PTE
560	 */
561	moea_pte_unset(pt, pvo_pt, va);
562	moea_pte_set(pt, pvo_pt);
563}
564
565/*
566 * Quick sort callout for comparing memory regions.
567 */
568static int	mr_cmp(const void *a, const void *b);
569static int	om_cmp(const void *a, const void *b);
570
571static int
572mr_cmp(const void *a, const void *b)
573{
574	const struct	mem_region *regiona;
575	const struct	mem_region *regionb;
576
577	regiona = a;
578	regionb = b;
579	if (regiona->mr_start < regionb->mr_start)
580		return (-1);
581	else if (regiona->mr_start > regionb->mr_start)
582		return (1);
583	else
584		return (0);
585}
586
587static int
588om_cmp(const void *a, const void *b)
589{
590	const struct	ofw_map *mapa;
591	const struct	ofw_map *mapb;
592
593	mapa = a;
594	mapb = b;
595	if (mapa->om_pa < mapb->om_pa)
596		return (-1);
597	else if (mapa->om_pa > mapb->om_pa)
598		return (1);
599	else
600		return (0);
601}
602
603void
604moea_bootstrap(mmu_t mmup, vm_offset_t kernelstart, vm_offset_t kernelend)
605{
606	ihandle_t	mmui;
607	phandle_t	chosen, mmu;
608	int		sz;
609	int		i, j;
610	int		ofw_mappings;
611	vm_size_t	size, physsz, hwphyssz;
612	vm_offset_t	pa, va, off;
613	u_int		batl, batu;
614
615        /*
616         * Set up BAT0 to map the lowest 256 MB area
617         */
618        battable[0x0].batl = BATL(0x00000000, BAT_M, BAT_PP_RW);
619        battable[0x0].batu = BATU(0x00000000, BAT_BL_256M, BAT_Vs);
620
621        /*
622         * Map PCI memory space.
623         */
624        battable[0x8].batl = BATL(0x80000000, BAT_I|BAT_G, BAT_PP_RW);
625        battable[0x8].batu = BATU(0x80000000, BAT_BL_256M, BAT_Vs);
626
627        battable[0x9].batl = BATL(0x90000000, BAT_I|BAT_G, BAT_PP_RW);
628        battable[0x9].batu = BATU(0x90000000, BAT_BL_256M, BAT_Vs);
629
630        battable[0xa].batl = BATL(0xa0000000, BAT_I|BAT_G, BAT_PP_RW);
631        battable[0xa].batu = BATU(0xa0000000, BAT_BL_256M, BAT_Vs);
632
633        battable[0xb].batl = BATL(0xb0000000, BAT_I|BAT_G, BAT_PP_RW);
634        battable[0xb].batu = BATU(0xb0000000, BAT_BL_256M, BAT_Vs);
635
636        /*
637         * Map obio devices.
638         */
639        battable[0xf].batl = BATL(0xf0000000, BAT_I|BAT_G, BAT_PP_RW);
640        battable[0xf].batu = BATU(0xf0000000, BAT_BL_256M, BAT_Vs);
641
642	/*
643	 * Use an IBAT and a DBAT to map the bottom segment of memory
644	 * where we are.
645	 */
646	batu = BATU(0x00000000, BAT_BL_256M, BAT_Vs);
647	batl = BATL(0x00000000, BAT_M, BAT_PP_RW);
648	__asm (".balign 32; \n"
649	       "mtibatu 0,%0; mtibatl 0,%1; isync; \n"
650	       "mtdbatu 0,%0; mtdbatl 0,%1; isync"
651	    :: "r"(batu), "r"(batl));
652
653#if 0
654	/* map frame buffer */
655	batu = BATU(0x90000000, BAT_BL_256M, BAT_Vs);
656	batl = BATL(0x90000000, BAT_I|BAT_G, BAT_PP_RW);
657	__asm ("mtdbatu 1,%0; mtdbatl 1,%1; isync"
658	    :: "r"(batu), "r"(batl));
659#endif
660
661#if 1
662	/* map pci space */
663	batu = BATU(0x80000000, BAT_BL_256M, BAT_Vs);
664	batl = BATL(0x80000000, BAT_I|BAT_G, BAT_PP_RW);
665	__asm ("mtdbatu 1,%0; mtdbatl 1,%1; isync"
666	    :: "r"(batu), "r"(batl));
667#endif
668
669	/*
670	 * Set the start and end of kva.
671	 */
672	virtual_avail = VM_MIN_KERNEL_ADDRESS;
673	virtual_end = VM_MAX_KERNEL_ADDRESS;
674
675	mem_regions(&pregions, &pregions_sz, &regions, &regions_sz);
676	CTR0(KTR_PMAP, "moea_bootstrap: physical memory");
677
678	qsort(pregions, pregions_sz, sizeof(*pregions), mr_cmp);
679	for (i = 0; i < pregions_sz; i++) {
680		vm_offset_t pa;
681		vm_offset_t end;
682
683		CTR3(KTR_PMAP, "physregion: %#x - %#x (%#x)",
684			pregions[i].mr_start,
685			pregions[i].mr_start + pregions[i].mr_size,
686			pregions[i].mr_size);
687		/*
688		 * Install entries into the BAT table to allow all
689		 * of physmem to be convered by on-demand BAT entries.
690		 * The loop will sometimes set the same battable element
691		 * twice, but that's fine since they won't be used for
692		 * a while yet.
693		 */
694		pa = pregions[i].mr_start & 0xf0000000;
695		end = pregions[i].mr_start + pregions[i].mr_size;
696		do {
697                        u_int n = pa >> ADDR_SR_SHFT;
698
699			battable[n].batl = BATL(pa, BAT_M, BAT_PP_RW);
700			battable[n].batu = BATU(pa, BAT_BL_256M, BAT_Vs);
701			pa += SEGMENT_LENGTH;
702		} while (pa < end);
703	}
704
705	if (sizeof(phys_avail)/sizeof(phys_avail[0]) < regions_sz)
706		panic("moea_bootstrap: phys_avail too small");
707	qsort(regions, regions_sz, sizeof(*regions), mr_cmp);
708	phys_avail_count = 0;
709	physsz = 0;
710	hwphyssz = 0;
711	TUNABLE_ULONG_FETCH("hw.physmem", (u_long *) &hwphyssz);
712	for (i = 0, j = 0; i < regions_sz; i++, j += 2) {
713		CTR3(KTR_PMAP, "region: %#x - %#x (%#x)", regions[i].mr_start,
714		    regions[i].mr_start + regions[i].mr_size,
715		    regions[i].mr_size);
716		if (hwphyssz != 0 &&
717		    (physsz + regions[i].mr_size) >= hwphyssz) {
718			if (physsz < hwphyssz) {
719				phys_avail[j] = regions[i].mr_start;
720				phys_avail[j + 1] = regions[i].mr_start +
721				    hwphyssz - physsz;
722				physsz = hwphyssz;
723				phys_avail_count++;
724			}
725			break;
726		}
727		phys_avail[j] = regions[i].mr_start;
728		phys_avail[j + 1] = regions[i].mr_start + regions[i].mr_size;
729		phys_avail_count++;
730		physsz += regions[i].mr_size;
731	}
732	physmem = btoc(physsz);
733
734	/*
735	 * Allocate PTEG table.
736	 */
737#ifdef PTEGCOUNT
738	moea_pteg_count = PTEGCOUNT;
739#else
740	moea_pteg_count = 0x1000;
741
742	while (moea_pteg_count < physmem)
743		moea_pteg_count <<= 1;
744
745	moea_pteg_count >>= 1;
746#endif /* PTEGCOUNT */
747
748	size = moea_pteg_count * sizeof(struct pteg);
749	CTR2(KTR_PMAP, "moea_bootstrap: %d PTEGs, %d bytes", moea_pteg_count,
750	    size);
751	moea_pteg_table = (struct pteg *)moea_bootstrap_alloc(size, size);
752	CTR1(KTR_PMAP, "moea_bootstrap: PTEG table at %p", moea_pteg_table);
753	bzero((void *)moea_pteg_table, moea_pteg_count * sizeof(struct pteg));
754	moea_pteg_mask = moea_pteg_count - 1;
755
756	/*
757	 * Allocate pv/overflow lists.
758	 */
759	size = sizeof(struct pvo_head) * moea_pteg_count;
760	moea_pvo_table = (struct pvo_head *)moea_bootstrap_alloc(size,
761	    PAGE_SIZE);
762	CTR1(KTR_PMAP, "moea_bootstrap: PVO table at %p", moea_pvo_table);
763	for (i = 0; i < moea_pteg_count; i++)
764		LIST_INIT(&moea_pvo_table[i]);
765
766	/*
767	 * Initialize the lock that synchronizes access to the pteg and pvo
768	 * tables.
769	 */
770	mtx_init(&moea_table_mutex, "pmap table", NULL, MTX_DEF);
771
772	/*
773	 * Allocate the message buffer.
774	 */
775	msgbuf_phys = moea_bootstrap_alloc(MSGBUF_SIZE, 0);
776
777	/*
778	 * Initialise the unmanaged pvo pool.
779	 */
780	moea_bpvo_pool = (struct pvo_entry *)moea_bootstrap_alloc(
781		BPVO_POOL_SIZE*sizeof(struct pvo_entry), 0);
782	moea_bpvo_pool_index = 0;
783
784	/*
785	 * Make sure kernel vsid is allocated as well as VSID 0.
786	 */
787	moea_vsid_bitmap[(KERNEL_VSIDBITS & (NPMAPS - 1)) / VSID_NBPW]
788		|= 1 << (KERNEL_VSIDBITS % VSID_NBPW);
789	moea_vsid_bitmap[0] |= 1;
790
791	/*
792	 * Set up the Open Firmware pmap and add it's mappings.
793	 */
794	moea_pinit(mmup, &ofw_pmap);
795	ofw_pmap.pm_sr[KERNEL_SR] = KERNEL_SEGMENT;
796	ofw_pmap.pm_sr[KERNEL2_SR] = KERNEL2_SEGMENT;
797	if ((chosen = OF_finddevice("/chosen")) == -1)
798		panic("moea_bootstrap: can't find /chosen");
799	OF_getprop(chosen, "mmu", &mmui, 4);
800	if ((mmu = OF_instance_to_package(mmui)) == -1)
801		panic("moea_bootstrap: can't get mmu package");
802	if ((sz = OF_getproplen(mmu, "translations")) == -1)
803		panic("moea_bootstrap: can't get ofw translation count");
804	translations = NULL;
805	for (i = 0; phys_avail[i] != 0; i += 2) {
806		if (phys_avail[i + 1] >= sz) {
807			translations = (struct ofw_map *)phys_avail[i];
808			break;
809		}
810	}
811	if (translations == NULL)
812		panic("moea_bootstrap: no space to copy translations");
813	bzero(translations, sz);
814	if (OF_getprop(mmu, "translations", translations, sz) == -1)
815		panic("moea_bootstrap: can't get ofw translations");
816	CTR0(KTR_PMAP, "moea_bootstrap: translations");
817	sz /= sizeof(*translations);
818	qsort(translations, sz, sizeof (*translations), om_cmp);
819	for (i = 0, ofw_mappings = 0; i < sz; i++) {
820		CTR3(KTR_PMAP, "translation: pa=%#x va=%#x len=%#x",
821		    translations[i].om_pa, translations[i].om_va,
822		    translations[i].om_len);
823
824		/*
825		 * If the mapping is 1:1, let the RAM and device on-demand
826		 * BAT tables take care of the translation.
827		 */
828		if (translations[i].om_va == translations[i].om_pa)
829			continue;
830
831		/* Enter the pages */
832		for (off = 0; off < translations[i].om_len; off += PAGE_SIZE) {
833			struct	vm_page m;
834
835			m.phys_addr = translations[i].om_pa + off;
836			moea_enter_locked(&ofw_pmap,
837				   translations[i].om_va + off, &m,
838				   VM_PROT_ALL, 1);
839			ofw_mappings++;
840		}
841	}
842#ifdef SMP
843	TLBSYNC();
844#endif
845
846	/*
847	 * Initialize the kernel pmap (which is statically allocated).
848	 */
849	PMAP_LOCK_INIT(kernel_pmap);
850	for (i = 0; i < 16; i++) {
851		kernel_pmap->pm_sr[i] = EMPTY_SEGMENT;
852	}
853	kernel_pmap->pm_sr[KERNEL_SR] = KERNEL_SEGMENT;
854	kernel_pmap->pm_sr[KERNEL2_SR] = KERNEL2_SEGMENT;
855	kernel_pmap->pm_active = ~0;
856
857	/*
858	 * Allocate a kernel stack with a guard page for thread0 and map it
859	 * into the kernel page map.
860	 */
861	pa = moea_bootstrap_alloc(KSTACK_PAGES * PAGE_SIZE, 0);
862	kstack0_phys = pa;
863	kstack0 = virtual_avail + (KSTACK_GUARD_PAGES * PAGE_SIZE);
864	CTR2(KTR_PMAP, "moea_bootstrap: kstack0 at %#x (%#x)", kstack0_phys,
865	    kstack0);
866	virtual_avail += (KSTACK_PAGES + KSTACK_GUARD_PAGES) * PAGE_SIZE;
867	for (i = 0; i < KSTACK_PAGES; i++) {
868		pa = kstack0_phys + i * PAGE_SIZE;
869		va = kstack0 + i * PAGE_SIZE;
870		moea_kenter(mmup, va, pa);
871		TLBIE(va);
872	}
873
874	/*
875	 * Calculate the last available physical address.
876	 */
877	for (i = 0; phys_avail[i + 2] != 0; i += 2)
878		;
879	Maxmem = powerpc_btop(phys_avail[i + 1]);
880
881	/*
882	 * Allocate virtual address space for the message buffer.
883	 */
884	msgbufp = (struct msgbuf *)virtual_avail;
885	virtual_avail += round_page(MSGBUF_SIZE);
886
887	/*
888	 * Initialize hardware.
889	 */
890	for (i = 0; i < 16; i++) {
891		mtsrin(i << ADDR_SR_SHFT, EMPTY_SEGMENT);
892	}
893	__asm __volatile ("mtsr %0,%1"
894	    :: "n"(KERNEL_SR), "r"(KERNEL_SEGMENT));
895	__asm __volatile ("mtsr %0,%1"
896	    :: "n"(KERNEL2_SR), "r"(KERNEL2_SEGMENT));
897	__asm __volatile ("sync; mtsdr1 %0; isync"
898	    :: "r"((u_int)moea_pteg_table | (moea_pteg_mask >> 10)));
899	tlbia();
900
901	pmap_bootstrapped++;
902}
903
904/*
905 * Activate a user pmap.  The pmap must be activated before it's address
906 * space can be accessed in any way.
907 */
908void
909moea_activate(mmu_t mmu, struct thread *td)
910{
911	pmap_t	pm, pmr;
912
913	/*
914	 * Load all the data we need up front to encourage the compiler to
915	 * not issue any loads while we have interrupts disabled below.
916	 */
917	pm = &td->td_proc->p_vmspace->vm_pmap;
918
919	if ((pmr = (pmap_t)moea_kextract(mmu, (vm_offset_t)pm)) == NULL)
920		pmr = pm;
921
922	pm->pm_active |= PCPU_GET(cpumask);
923	PCPU_SET(curpmap, pmr);
924}
925
926void
927moea_deactivate(mmu_t mmu, struct thread *td)
928{
929	pmap_t	pm;
930
931	pm = &td->td_proc->p_vmspace->vm_pmap;
932	pm->pm_active &= ~(PCPU_GET(cpumask));
933	PCPU_SET(curpmap, NULL);
934}
935
936void
937moea_change_wiring(mmu_t mmu, pmap_t pm, vm_offset_t va, boolean_t wired)
938{
939	struct	pvo_entry *pvo;
940
941	PMAP_LOCK(pm);
942	pvo = moea_pvo_find_va(pm, va & ~ADDR_POFF, NULL);
943
944	if (pvo != NULL) {
945		if (wired) {
946			if ((pvo->pvo_vaddr & PVO_WIRED) == 0)
947				pm->pm_stats.wired_count++;
948			pvo->pvo_vaddr |= PVO_WIRED;
949		} else {
950			if ((pvo->pvo_vaddr & PVO_WIRED) != 0)
951				pm->pm_stats.wired_count--;
952			pvo->pvo_vaddr &= ~PVO_WIRED;
953		}
954	}
955	PMAP_UNLOCK(pm);
956}
957
958void
959moea_copy_page(mmu_t mmu, vm_page_t msrc, vm_page_t mdst)
960{
961	vm_offset_t	dst;
962	vm_offset_t	src;
963
964	dst = VM_PAGE_TO_PHYS(mdst);
965	src = VM_PAGE_TO_PHYS(msrc);
966
967	kcopy((void *)src, (void *)dst, PAGE_SIZE);
968}
969
970/*
971 * Zero a page of physical memory by temporarily mapping it into the tlb.
972 */
973void
974moea_zero_page(mmu_t mmu, vm_page_t m)
975{
976	vm_offset_t pa = VM_PAGE_TO_PHYS(m);
977	caddr_t va;
978
979	if (pa < SEGMENT_LENGTH) {
980		va = (caddr_t) pa;
981	} else if (moea_initialized) {
982		if (moea_pvo_zeropage == NULL)
983			moea_pvo_zeropage = moea_rkva_alloc(mmu);
984		moea_pa_map(moea_pvo_zeropage, pa, NULL, NULL);
985		va = (caddr_t)PVO_VADDR(moea_pvo_zeropage);
986	} else {
987		panic("moea_zero_page: can't zero pa %#x", pa);
988	}
989
990	bzero(va, PAGE_SIZE);
991
992	if (pa >= SEGMENT_LENGTH)
993		moea_pa_unmap(moea_pvo_zeropage, NULL, NULL);
994}
995
996void
997moea_zero_page_area(mmu_t mmu, vm_page_t m, int off, int size)
998{
999	vm_offset_t pa = VM_PAGE_TO_PHYS(m);
1000	caddr_t va;
1001
1002	if (pa < SEGMENT_LENGTH) {
1003		va = (caddr_t) pa;
1004	} else if (moea_initialized) {
1005		if (moea_pvo_zeropage == NULL)
1006			moea_pvo_zeropage = moea_rkva_alloc(mmu);
1007		moea_pa_map(moea_pvo_zeropage, pa, NULL, NULL);
1008		va = (caddr_t)PVO_VADDR(moea_pvo_zeropage);
1009	} else {
1010		panic("moea_zero_page: can't zero pa %#x", pa);
1011	}
1012
1013	bzero(va + off, size);
1014
1015	if (pa >= SEGMENT_LENGTH)
1016		moea_pa_unmap(moea_pvo_zeropage, NULL, NULL);
1017}
1018
1019void
1020moea_zero_page_idle(mmu_t mmu, vm_page_t m)
1021{
1022
1023	/* XXX this is called outside of Giant, is moea_zero_page safe? */
1024	/* XXX maybe have a dedicated mapping for this to avoid the problem? */
1025	mtx_lock(&Giant);
1026	moea_zero_page(mmu, m);
1027	mtx_unlock(&Giant);
1028}
1029
1030/*
1031 * Map the given physical page at the specified virtual address in the
1032 * target pmap with the protection requested.  If specified the page
1033 * will be wired down.
1034 */
1035void
1036moea_enter(mmu_t mmu, pmap_t pmap, vm_offset_t va, vm_page_t m, vm_prot_t prot,
1037	   boolean_t wired)
1038{
1039
1040	vm_page_lock_queues();
1041	PMAP_LOCK(pmap);
1042	moea_enter_locked(pmap, va, m, prot, wired);
1043	vm_page_unlock_queues();
1044	PMAP_UNLOCK(pmap);
1045}
1046
1047/*
1048 * Map the given physical page at the specified virtual address in the
1049 * target pmap with the protection requested.  If specified the page
1050 * will be wired down.
1051 *
1052 * The page queues and pmap must be locked.
1053 */
1054static void
1055moea_enter_locked(pmap_t pmap, vm_offset_t va, vm_page_t m, vm_prot_t prot,
1056    boolean_t wired)
1057{
1058	struct		pvo_head *pvo_head;
1059	uma_zone_t	zone;
1060	vm_page_t	pg;
1061	u_int		pte_lo, pvo_flags, was_exec, i;
1062	int		error;
1063
1064	if (!moea_initialized) {
1065		pvo_head = &moea_pvo_kunmanaged;
1066		zone = moea_upvo_zone;
1067		pvo_flags = 0;
1068		pg = NULL;
1069		was_exec = PTE_EXEC;
1070	} else {
1071		pvo_head = vm_page_to_pvoh(m);
1072		pg = m;
1073		zone = moea_mpvo_zone;
1074		pvo_flags = PVO_MANAGED;
1075		was_exec = 0;
1076	}
1077	if (pmap_bootstrapped)
1078		mtx_assert(&vm_page_queue_mtx, MA_OWNED);
1079	PMAP_LOCK_ASSERT(pmap, MA_OWNED);
1080
1081	/* XXX change the pvo head for fake pages */
1082	if ((m->flags & PG_FICTITIOUS) == PG_FICTITIOUS)
1083		pvo_head = &moea_pvo_kunmanaged;
1084
1085	/*
1086	 * If this is a managed page, and it's the first reference to the page,
1087	 * clear the execness of the page.  Otherwise fetch the execness.
1088	 */
1089	if ((pg != NULL) && ((m->flags & PG_FICTITIOUS) == 0)) {
1090		if (LIST_EMPTY(pvo_head)) {
1091			moea_attr_clear(pg, PTE_EXEC);
1092		} else {
1093			was_exec = moea_attr_fetch(pg) & PTE_EXEC;
1094		}
1095	}
1096
1097	/*
1098	 * Assume the page is cache inhibited and access is guarded unless
1099	 * it's in our available memory array.
1100	 */
1101	pte_lo = PTE_I | PTE_G;
1102	for (i = 0; i < pregions_sz; i++) {
1103		if ((VM_PAGE_TO_PHYS(m) >= pregions[i].mr_start) &&
1104		    (VM_PAGE_TO_PHYS(m) <
1105			(pregions[i].mr_start + pregions[i].mr_size))) {
1106			pte_lo &= ~(PTE_I | PTE_G);
1107			break;
1108		}
1109	}
1110
1111	if (prot & VM_PROT_WRITE)
1112		pte_lo |= PTE_BW;
1113	else
1114		pte_lo |= PTE_BR;
1115
1116	if (prot & VM_PROT_EXECUTE)
1117		pvo_flags |= PVO_EXECUTABLE;
1118
1119	if (wired)
1120		pvo_flags |= PVO_WIRED;
1121
1122	if ((m->flags & PG_FICTITIOUS) != 0)
1123		pvo_flags |= PVO_FAKE;
1124
1125	error = moea_pvo_enter(pmap, zone, pvo_head, va, VM_PAGE_TO_PHYS(m),
1126	    pte_lo, pvo_flags);
1127
1128	/*
1129	 * Flush the real page from the instruction cache if this page is
1130	 * mapped executable and cacheable and was not previously mapped (or
1131	 * was not mapped executable).
1132	 */
1133	if (error == 0 && (pvo_flags & PVO_EXECUTABLE) &&
1134	    (pte_lo & PTE_I) == 0 && was_exec == 0) {
1135		/*
1136		 * Flush the real memory from the cache.
1137		 */
1138		moea_syncicache(VM_PAGE_TO_PHYS(m), PAGE_SIZE);
1139		if (pg != NULL)
1140			moea_attr_save(pg, PTE_EXEC);
1141	}
1142
1143	/* XXX syncicache always until problems are sorted */
1144	moea_syncicache(VM_PAGE_TO_PHYS(m), PAGE_SIZE);
1145}
1146
1147/*
1148 * Maps a sequence of resident pages belonging to the same object.
1149 * The sequence begins with the given page m_start.  This page is
1150 * mapped at the given virtual address start.  Each subsequent page is
1151 * mapped at a virtual address that is offset from start by the same
1152 * amount as the page is offset from m_start within the object.  The
1153 * last page in the sequence is the page with the largest offset from
1154 * m_start that can be mapped at a virtual address less than the given
1155 * virtual address end.  Not every virtual page between start and end
1156 * is mapped; only those for which a resident page exists with the
1157 * corresponding offset from m_start are mapped.
1158 */
1159void
1160moea_enter_object(mmu_t mmu, pmap_t pm, vm_offset_t start, vm_offset_t end,
1161    vm_page_t m_start, vm_prot_t prot)
1162{
1163	vm_page_t m;
1164	vm_pindex_t diff, psize;
1165
1166	psize = atop(end - start);
1167	m = m_start;
1168	PMAP_LOCK(pm);
1169	while (m != NULL && (diff = m->pindex - m_start->pindex) < psize) {
1170		moea_enter_locked(pm, start + ptoa(diff), m, prot &
1171		    (VM_PROT_READ | VM_PROT_EXECUTE), FALSE);
1172		m = TAILQ_NEXT(m, listq);
1173	}
1174	PMAP_UNLOCK(pm);
1175}
1176
1177vm_page_t
1178moea_enter_quick(mmu_t mmu, pmap_t pm, vm_offset_t va, vm_page_t m,
1179    vm_prot_t prot, vm_page_t mpte)
1180{
1181
1182	PMAP_LOCK(pm);
1183	moea_enter_locked(pm, va, m, prot & (VM_PROT_READ | VM_PROT_EXECUTE),
1184	    FALSE);
1185	PMAP_UNLOCK(pm);
1186	return (NULL);
1187}
1188
1189vm_paddr_t
1190moea_extract(mmu_t mmu, pmap_t pm, vm_offset_t va)
1191{
1192	struct	pvo_entry *pvo;
1193	vm_paddr_t pa;
1194
1195	PMAP_LOCK(pm);
1196	pvo = moea_pvo_find_va(pm, va & ~ADDR_POFF, NULL);
1197	if (pvo == NULL)
1198		pa = 0;
1199	else
1200		pa = (pvo->pvo_pte.pte_lo & PTE_RPGN) | (va & ADDR_POFF);
1201	PMAP_UNLOCK(pm);
1202	return (pa);
1203}
1204
1205/*
1206 * Atomically extract and hold the physical page with the given
1207 * pmap and virtual address pair if that mapping permits the given
1208 * protection.
1209 */
1210vm_page_t
1211moea_extract_and_hold(mmu_t mmu, pmap_t pmap, vm_offset_t va, vm_prot_t prot)
1212{
1213	struct	pvo_entry *pvo;
1214	vm_page_t m;
1215
1216	m = NULL;
1217	mtx_lock(&Giant);
1218	vm_page_lock_queues();
1219	PMAP_LOCK(pmap);
1220	pvo = moea_pvo_find_va(pmap, va & ~ADDR_POFF, NULL);
1221	if (pvo != NULL && (pvo->pvo_pte.pte_hi & PTE_VALID) &&
1222	    ((pvo->pvo_pte.pte_lo & PTE_PP) == PTE_RW ||
1223	     (prot & VM_PROT_WRITE) == 0)) {
1224		m = PHYS_TO_VM_PAGE(pvo->pvo_pte.pte_lo & PTE_RPGN);
1225		vm_page_hold(m);
1226	}
1227	vm_page_unlock_queues();
1228	PMAP_UNLOCK(pmap);
1229	mtx_unlock(&Giant);
1230	return (m);
1231}
1232
1233void
1234moea_init(mmu_t mmu)
1235{
1236
1237	CTR0(KTR_PMAP, "moea_init");
1238
1239	moea_upvo_zone = uma_zcreate("UPVO entry", sizeof (struct pvo_entry),
1240	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
1241	    UMA_ZONE_VM | UMA_ZONE_NOFREE);
1242	moea_mpvo_zone = uma_zcreate("MPVO entry", sizeof(struct pvo_entry),
1243	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
1244	    UMA_ZONE_VM | UMA_ZONE_NOFREE);
1245	moea_initialized = TRUE;
1246}
1247
1248boolean_t
1249moea_is_modified(mmu_t mmu, vm_page_t m)
1250{
1251
1252	if ((m->flags & (PG_FICTITIOUS |PG_UNMANAGED)) != 0)
1253		return (FALSE);
1254
1255	return (moea_query_bit(m, PTE_CHG));
1256}
1257
1258void
1259moea_clear_reference(mmu_t mmu, vm_page_t m)
1260{
1261
1262	if ((m->flags & (PG_FICTITIOUS | PG_UNMANAGED)) != 0)
1263		return;
1264	moea_clear_bit(m, PTE_REF, NULL);
1265}
1266
1267void
1268moea_clear_modify(mmu_t mmu, vm_page_t m)
1269{
1270
1271	if ((m->flags & (PG_FICTITIOUS | PG_UNMANAGED)) != 0)
1272		return;
1273	moea_clear_bit(m, PTE_CHG, NULL);
1274}
1275
1276/*
1277 *	moea_ts_referenced:
1278 *
1279 *	Return a count of reference bits for a page, clearing those bits.
1280 *	It is not necessary for every reference bit to be cleared, but it
1281 *	is necessary that 0 only be returned when there are truly no
1282 *	reference bits set.
1283 *
1284 *	XXX: The exact number of bits to check and clear is a matter that
1285 *	should be tested and standardized at some point in the future for
1286 *	optimal aging of shared pages.
1287 */
1288boolean_t
1289moea_ts_referenced(mmu_t mmu, vm_page_t m)
1290{
1291	int count;
1292
1293	if ((m->flags & (PG_FICTITIOUS | PG_UNMANAGED)) != 0)
1294		return (0);
1295
1296	count = moea_clear_bit(m, PTE_REF, NULL);
1297
1298	return (count);
1299}
1300
1301/*
1302 * Map a wired page into kernel virtual address space.
1303 */
1304void
1305moea_kenter(mmu_t mmu, vm_offset_t va, vm_offset_t pa)
1306{
1307	u_int		pte_lo;
1308	int		error;
1309	int		i;
1310
1311#if 0
1312	if (va < VM_MIN_KERNEL_ADDRESS)
1313		panic("moea_kenter: attempt to enter non-kernel address %#x",
1314		    va);
1315#endif
1316
1317	pte_lo = PTE_I | PTE_G;
1318	for (i = 0; i < pregions_sz; i++) {
1319		if ((pa >= pregions[i].mr_start) &&
1320		    (pa < (pregions[i].mr_start + pregions[i].mr_size))) {
1321			pte_lo &= ~(PTE_I | PTE_G);
1322			break;
1323		}
1324	}
1325
1326	PMAP_LOCK(kernel_pmap);
1327	error = moea_pvo_enter(kernel_pmap, moea_upvo_zone,
1328	    &moea_pvo_kunmanaged, va, pa, pte_lo, PVO_WIRED);
1329
1330	if (error != 0 && error != ENOENT)
1331		panic("moea_kenter: failed to enter va %#x pa %#x: %d", va,
1332		    pa, error);
1333
1334	/*
1335	 * Flush the real memory from the instruction cache.
1336	 */
1337	if ((pte_lo & (PTE_I | PTE_G)) == 0) {
1338		moea_syncicache(pa, PAGE_SIZE);
1339	}
1340	PMAP_UNLOCK(kernel_pmap);
1341}
1342
1343/*
1344 * Extract the physical page address associated with the given kernel virtual
1345 * address.
1346 */
1347vm_offset_t
1348moea_kextract(mmu_t mmu, vm_offset_t va)
1349{
1350	struct		pvo_entry *pvo;
1351	vm_paddr_t pa;
1352
1353#ifdef UMA_MD_SMALL_ALLOC
1354	/*
1355	 * Allow direct mappings
1356	 */
1357	if (va < VM_MIN_KERNEL_ADDRESS) {
1358		return (va);
1359	}
1360#endif
1361
1362	PMAP_LOCK(kernel_pmap);
1363	pvo = moea_pvo_find_va(kernel_pmap, va & ~ADDR_POFF, NULL);
1364	KASSERT(pvo != NULL, ("moea_kextract: no addr found"));
1365	pa = (pvo->pvo_pte.pte_lo & PTE_RPGN) | (va & ADDR_POFF);
1366	PMAP_UNLOCK(kernel_pmap);
1367	return (pa);
1368}
1369
1370/*
1371 * Remove a wired page from kernel virtual address space.
1372 */
1373void
1374moea_kremove(mmu_t mmu, vm_offset_t va)
1375{
1376
1377	moea_remove(mmu, kernel_pmap, va, va + PAGE_SIZE);
1378}
1379
1380/*
1381 * Map a range of physical addresses into kernel virtual address space.
1382 *
1383 * The value passed in *virt is a suggested virtual address for the mapping.
1384 * Architectures which can support a direct-mapped physical to virtual region
1385 * can return the appropriate address within that region, leaving '*virt'
1386 * unchanged.  We cannot and therefore do not; *virt is updated with the
1387 * first usable address after the mapped region.
1388 */
1389vm_offset_t
1390moea_map(mmu_t mmu, vm_offset_t *virt, vm_offset_t pa_start,
1391    vm_offset_t pa_end, int prot)
1392{
1393	vm_offset_t	sva, va;
1394
1395	sva = *virt;
1396	va = sva;
1397	for (; pa_start < pa_end; pa_start += PAGE_SIZE, va += PAGE_SIZE)
1398		moea_kenter(mmu, va, pa_start);
1399	*virt = va;
1400	return (sva);
1401}
1402
1403/*
1404 * Lower the permission for all mappings to a given page.
1405 */
1406void
1407moea_page_protect(mmu_t mmu, vm_page_t m, vm_prot_t prot)
1408{
1409	struct	pvo_head *pvo_head;
1410	struct	pvo_entry *pvo, *next_pvo;
1411	struct	pte *pt;
1412	pmap_t	pmap;
1413
1414	/*
1415	 * Since the routine only downgrades protection, if the
1416	 * maximal protection is desired, there isn't any change
1417	 * to be made.
1418	 */
1419	if ((prot & (VM_PROT_READ|VM_PROT_WRITE)) ==
1420	    (VM_PROT_READ|VM_PROT_WRITE))
1421		return;
1422
1423	pvo_head = vm_page_to_pvoh(m);
1424	for (pvo = LIST_FIRST(pvo_head); pvo != NULL; pvo = next_pvo) {
1425		next_pvo = LIST_NEXT(pvo, pvo_vlink);
1426		MOEA_PVO_CHECK(pvo);	/* sanity check */
1427		pmap = pvo->pvo_pmap;
1428		PMAP_LOCK(pmap);
1429
1430		/*
1431		 * Downgrading to no mapping at all, we just remove the entry.
1432		 */
1433		if ((prot & VM_PROT_READ) == 0) {
1434			moea_pvo_remove(pvo, -1);
1435			PMAP_UNLOCK(pmap);
1436			continue;
1437		}
1438
1439		/*
1440		 * If EXEC permission is being revoked, just clear the flag
1441		 * in the PVO.
1442		 */
1443		if ((prot & VM_PROT_EXECUTE) == 0)
1444			pvo->pvo_vaddr &= ~PVO_EXECUTABLE;
1445
1446		/*
1447		 * If this entry is already RO, don't diddle with the page
1448		 * table.
1449		 */
1450		if ((pvo->pvo_pte.pte_lo & PTE_PP) == PTE_BR) {
1451			PMAP_UNLOCK(pmap);
1452			MOEA_PVO_CHECK(pvo);
1453			continue;
1454		}
1455
1456		/*
1457		 * Grab the PTE before we diddle the bits so pvo_to_pte can
1458		 * verify the pte contents are as expected.
1459		 */
1460		pt = moea_pvo_to_pte(pvo, -1);
1461		pvo->pvo_pte.pte_lo &= ~PTE_PP;
1462		pvo->pvo_pte.pte_lo |= PTE_BR;
1463		if (pt != NULL)
1464			moea_pte_change(pt, &pvo->pvo_pte, pvo->pvo_vaddr);
1465		PMAP_UNLOCK(pmap);
1466		MOEA_PVO_CHECK(pvo);	/* sanity check */
1467	}
1468
1469	/*
1470	 * Downgrading from writeable: clear the VM page flag
1471	 */
1472	if ((prot & VM_PROT_WRITE) != VM_PROT_WRITE)
1473		vm_page_flag_clear(m, PG_WRITEABLE);
1474}
1475
1476/*
1477 * Returns true if the pmap's pv is one of the first
1478 * 16 pvs linked to from this page.  This count may
1479 * be changed upwards or downwards in the future; it
1480 * is only necessary that true be returned for a small
1481 * subset of pmaps for proper page aging.
1482 */
1483boolean_t
1484moea_page_exists_quick(mmu_t mmu, pmap_t pmap, vm_page_t m)
1485{
1486        int loops;
1487	struct pvo_entry *pvo;
1488
1489        if (!moea_initialized || (m->flags & PG_FICTITIOUS))
1490                return FALSE;
1491
1492	loops = 0;
1493	LIST_FOREACH(pvo, vm_page_to_pvoh(m), pvo_vlink) {
1494		if (pvo->pvo_pmap == pmap)
1495			return (TRUE);
1496		if (++loops >= 16)
1497			break;
1498	}
1499
1500	return (FALSE);
1501}
1502
1503static u_int	moea_vsidcontext;
1504
1505void
1506moea_pinit(mmu_t mmu, pmap_t pmap)
1507{
1508	int	i, mask;
1509	u_int	entropy;
1510
1511	KASSERT((int)pmap < VM_MIN_KERNEL_ADDRESS, ("moea_pinit: virt pmap"));
1512	PMAP_LOCK_INIT(pmap);
1513
1514	entropy = 0;
1515	__asm __volatile("mftb %0" : "=r"(entropy));
1516
1517	/*
1518	 * Allocate some segment registers for this pmap.
1519	 */
1520	for (i = 0; i < NPMAPS; i += VSID_NBPW) {
1521		u_int	hash, n;
1522
1523		/*
1524		 * Create a new value by mutiplying by a prime and adding in
1525		 * entropy from the timebase register.  This is to make the
1526		 * VSID more random so that the PT hash function collides
1527		 * less often.  (Note that the prime casues gcc to do shifts
1528		 * instead of a multiply.)
1529		 */
1530		moea_vsidcontext = (moea_vsidcontext * 0x1105) + entropy;
1531		hash = moea_vsidcontext & (NPMAPS - 1);
1532		if (hash == 0)		/* 0 is special, avoid it */
1533			continue;
1534		n = hash >> 5;
1535		mask = 1 << (hash & (VSID_NBPW - 1));
1536		hash = (moea_vsidcontext & 0xfffff);
1537		if (moea_vsid_bitmap[n] & mask) {	/* collision? */
1538			/* anything free in this bucket? */
1539			if (moea_vsid_bitmap[n] == 0xffffffff) {
1540				entropy = (moea_vsidcontext >> 20);
1541				continue;
1542			}
1543			i = ffs(~moea_vsid_bitmap[i]) - 1;
1544			mask = 1 << i;
1545			hash &= 0xfffff & ~(VSID_NBPW - 1);
1546			hash |= i;
1547		}
1548		moea_vsid_bitmap[n] |= mask;
1549		for (i = 0; i < 16; i++)
1550			pmap->pm_sr[i] = VSID_MAKE(i, hash);
1551		return;
1552	}
1553
1554	panic("moea_pinit: out of segments");
1555}
1556
1557/*
1558 * Initialize the pmap associated with process 0.
1559 */
1560void
1561moea_pinit0(mmu_t mmu, pmap_t pm)
1562{
1563
1564	moea_pinit(mmu, pm);
1565	bzero(&pm->pm_stats, sizeof(pm->pm_stats));
1566}
1567
1568/*
1569 * Set the physical protection on the specified range of this map as requested.
1570 */
1571void
1572moea_protect(mmu_t mmu, pmap_t pm, vm_offset_t sva, vm_offset_t eva,
1573    vm_prot_t prot)
1574{
1575	struct	pvo_entry *pvo;
1576	struct	pte *pt;
1577	int	pteidx;
1578
1579	CTR4(KTR_PMAP, "moea_protect: pm=%p sva=%#x eva=%#x prot=%#x", pm, sva,
1580	    eva, prot);
1581
1582
1583	KASSERT(pm == &curproc->p_vmspace->vm_pmap || pm == kernel_pmap,
1584	    ("moea_protect: non current pmap"));
1585
1586	if ((prot & VM_PROT_READ) == VM_PROT_NONE) {
1587		mtx_lock(&Giant);
1588		moea_remove(mmu, pm, sva, eva);
1589		mtx_unlock(&Giant);
1590		return;
1591	}
1592
1593	mtx_lock(&Giant);
1594	vm_page_lock_queues();
1595	PMAP_LOCK(pm);
1596	for (; sva < eva; sva += PAGE_SIZE) {
1597		pvo = moea_pvo_find_va(pm, sva, &pteidx);
1598		if (pvo == NULL)
1599			continue;
1600
1601		if ((prot & VM_PROT_EXECUTE) == 0)
1602			pvo->pvo_vaddr &= ~PVO_EXECUTABLE;
1603
1604		/*
1605		 * Grab the PTE pointer before we diddle with the cached PTE
1606		 * copy.
1607		 */
1608		pt = moea_pvo_to_pte(pvo, pteidx);
1609		/*
1610		 * Change the protection of the page.
1611		 */
1612		pvo->pvo_pte.pte_lo &= ~PTE_PP;
1613		pvo->pvo_pte.pte_lo |= PTE_BR;
1614
1615		/*
1616		 * If the PVO is in the page table, update that pte as well.
1617		 */
1618		if (pt != NULL)
1619			moea_pte_change(pt, &pvo->pvo_pte, pvo->pvo_vaddr);
1620	}
1621	vm_page_unlock_queues();
1622	PMAP_UNLOCK(pm);
1623	mtx_unlock(&Giant);
1624}
1625
1626/*
1627 * Map a list of wired pages into kernel virtual address space.  This is
1628 * intended for temporary mappings which do not need page modification or
1629 * references recorded.  Existing mappings in the region are overwritten.
1630 */
1631void
1632moea_qenter(mmu_t mmu, vm_offset_t sva, vm_page_t *m, int count)
1633{
1634	vm_offset_t va;
1635
1636	va = sva;
1637	while (count-- > 0) {
1638		moea_kenter(mmu, va, VM_PAGE_TO_PHYS(*m));
1639		va += PAGE_SIZE;
1640		m++;
1641	}
1642}
1643
1644/*
1645 * Remove page mappings from kernel virtual address space.  Intended for
1646 * temporary mappings entered by moea_qenter.
1647 */
1648void
1649moea_qremove(mmu_t mmu, vm_offset_t sva, int count)
1650{
1651	vm_offset_t va;
1652
1653	va = sva;
1654	while (count-- > 0) {
1655		moea_kremove(mmu, va);
1656		va += PAGE_SIZE;
1657	}
1658}
1659
1660void
1661moea_release(mmu_t mmu, pmap_t pmap)
1662{
1663        int idx, mask;
1664
1665	/*
1666	 * Free segment register's VSID
1667	 */
1668        if (pmap->pm_sr[0] == 0)
1669                panic("moea_release");
1670
1671        idx = VSID_TO_HASH(pmap->pm_sr[0]) & (NPMAPS-1);
1672        mask = 1 << (idx % VSID_NBPW);
1673        idx /= VSID_NBPW;
1674        moea_vsid_bitmap[idx] &= ~mask;
1675	PMAP_LOCK_DESTROY(pmap);
1676}
1677
1678/*
1679 * Remove the given range of addresses from the specified map.
1680 */
1681void
1682moea_remove(mmu_t mmu, pmap_t pm, vm_offset_t sva, vm_offset_t eva)
1683{
1684	struct	pvo_entry *pvo;
1685	int	pteidx;
1686
1687	vm_page_lock_queues();
1688	PMAP_LOCK(pm);
1689	for (; sva < eva; sva += PAGE_SIZE) {
1690		pvo = moea_pvo_find_va(pm, sva, &pteidx);
1691		if (pvo != NULL) {
1692			moea_pvo_remove(pvo, pteidx);
1693		}
1694	}
1695	PMAP_UNLOCK(pm);
1696	vm_page_unlock_queues();
1697}
1698
1699/*
1700 * Remove physical page from all pmaps in which it resides. moea_pvo_remove()
1701 * will reflect changes in pte's back to the vm_page.
1702 */
1703void
1704moea_remove_all(mmu_t mmu, vm_page_t m)
1705{
1706	struct  pvo_head *pvo_head;
1707	struct	pvo_entry *pvo, *next_pvo;
1708	pmap_t	pmap;
1709
1710	mtx_assert(&vm_page_queue_mtx, MA_OWNED);
1711
1712	pvo_head = vm_page_to_pvoh(m);
1713	for (pvo = LIST_FIRST(pvo_head); pvo != NULL; pvo = next_pvo) {
1714		next_pvo = LIST_NEXT(pvo, pvo_vlink);
1715
1716		MOEA_PVO_CHECK(pvo);	/* sanity check */
1717		pmap = pvo->pvo_pmap;
1718		PMAP_LOCK(pmap);
1719		moea_pvo_remove(pvo, -1);
1720		PMAP_UNLOCK(pmap);
1721	}
1722	vm_page_flag_clear(m, PG_WRITEABLE);
1723}
1724
1725/*
1726 * Allocate a physical page of memory directly from the phys_avail map.
1727 * Can only be called from moea_bootstrap before avail start and end are
1728 * calculated.
1729 */
1730static vm_offset_t
1731moea_bootstrap_alloc(vm_size_t size, u_int align)
1732{
1733	vm_offset_t	s, e;
1734	int		i, j;
1735
1736	size = round_page(size);
1737	for (i = 0; phys_avail[i + 1] != 0; i += 2) {
1738		if (align != 0)
1739			s = (phys_avail[i] + align - 1) & ~(align - 1);
1740		else
1741			s = phys_avail[i];
1742		e = s + size;
1743
1744		if (s < phys_avail[i] || e > phys_avail[i + 1])
1745			continue;
1746
1747		if (s == phys_avail[i]) {
1748			phys_avail[i] += size;
1749		} else if (e == phys_avail[i + 1]) {
1750			phys_avail[i + 1] -= size;
1751		} else {
1752			for (j = phys_avail_count * 2; j > i; j -= 2) {
1753				phys_avail[j] = phys_avail[j - 2];
1754				phys_avail[j + 1] = phys_avail[j - 1];
1755			}
1756
1757			phys_avail[i + 3] = phys_avail[i + 1];
1758			phys_avail[i + 1] = s;
1759			phys_avail[i + 2] = e;
1760			phys_avail_count++;
1761		}
1762
1763		return (s);
1764	}
1765	panic("moea_bootstrap_alloc: could not allocate memory");
1766}
1767
1768/*
1769 * Return an unmapped pvo for a kernel virtual address.
1770 * Used by pmap functions that operate on physical pages.
1771 */
1772static struct pvo_entry *
1773moea_rkva_alloc(mmu_t mmu)
1774{
1775	struct		pvo_entry *pvo;
1776	struct		pte *pt;
1777	vm_offset_t	kva;
1778	int		pteidx;
1779
1780	if (moea_rkva_count == 0)
1781		panic("moea_rkva_alloc: no more reserved KVAs");
1782
1783	kva = moea_rkva_start + (PAGE_SIZE * --moea_rkva_count);
1784	moea_kenter(mmu, kva, 0);
1785
1786	pvo = moea_pvo_find_va(kernel_pmap, kva, &pteidx);
1787
1788	if (pvo == NULL)
1789		panic("moea_kva_alloc: moea_pvo_find_va failed");
1790
1791	pt = moea_pvo_to_pte(pvo, pteidx);
1792
1793	if (pt == NULL)
1794		panic("moea_kva_alloc: moea_pvo_to_pte failed");
1795
1796	moea_pte_unset(pt, &pvo->pvo_pte, pvo->pvo_vaddr);
1797	PVO_PTEGIDX_CLR(pvo);
1798
1799	moea_pte_overflow++;
1800
1801	return (pvo);
1802}
1803
1804static void
1805moea_pa_map(struct pvo_entry *pvo, vm_offset_t pa, struct pte *saved_pt,
1806    int *depth_p)
1807{
1808	struct	pte *pt;
1809
1810	/*
1811	 * If this pvo already has a valid pte, we need to save it so it can
1812	 * be restored later.  We then just reload the new PTE over the old
1813	 * slot.
1814	 */
1815	if (saved_pt != NULL) {
1816		pt = moea_pvo_to_pte(pvo, -1);
1817
1818		if (pt != NULL) {
1819			moea_pte_unset(pt, &pvo->pvo_pte, pvo->pvo_vaddr);
1820			PVO_PTEGIDX_CLR(pvo);
1821			moea_pte_overflow++;
1822		}
1823
1824		*saved_pt = pvo->pvo_pte;
1825
1826		pvo->pvo_pte.pte_lo &= ~PTE_RPGN;
1827	}
1828
1829	pvo->pvo_pte.pte_lo |= pa;
1830
1831	if (!moea_pte_spill(pvo->pvo_vaddr))
1832		panic("moea_pa_map: could not spill pvo %p", pvo);
1833
1834	if (depth_p != NULL)
1835		(*depth_p)++;
1836}
1837
1838static void
1839moea_pa_unmap(struct pvo_entry *pvo, struct pte *saved_pt, int *depth_p)
1840{
1841	struct	pte *pt;
1842
1843	pt = moea_pvo_to_pte(pvo, -1);
1844
1845	if (pt != NULL) {
1846		moea_pte_unset(pt, &pvo->pvo_pte, pvo->pvo_vaddr);
1847		PVO_PTEGIDX_CLR(pvo);
1848		moea_pte_overflow++;
1849	}
1850
1851	pvo->pvo_pte.pte_lo &= ~PTE_RPGN;
1852
1853	/*
1854	 * If there is a saved PTE and it's valid, restore it and return.
1855	 */
1856	if (saved_pt != NULL && (saved_pt->pte_lo & PTE_RPGN) != 0) {
1857		if (depth_p != NULL && --(*depth_p) == 0)
1858			panic("moea_pa_unmap: restoring but depth == 0");
1859
1860		pvo->pvo_pte = *saved_pt;
1861
1862		if (!moea_pte_spill(pvo->pvo_vaddr))
1863			panic("moea_pa_unmap: could not spill pvo %p", pvo);
1864	}
1865}
1866
1867static void
1868moea_syncicache(vm_offset_t pa, vm_size_t len)
1869{
1870	__syncicache((void *)pa, len);
1871}
1872
1873static void
1874tlbia(void)
1875{
1876	caddr_t	i;
1877
1878	SYNC();
1879	for (i = 0; i < (caddr_t)0x00040000; i += 0x00001000) {
1880		TLBIE(i);
1881		EIEIO();
1882	}
1883	TLBSYNC();
1884	SYNC();
1885}
1886
1887static int
1888moea_pvo_enter(pmap_t pm, uma_zone_t zone, struct pvo_head *pvo_head,
1889    vm_offset_t va, vm_offset_t pa, u_int pte_lo, int flags)
1890{
1891	struct	pvo_entry *pvo;
1892	u_int	sr;
1893	int	first;
1894	u_int	ptegidx;
1895	int	i;
1896	int     bootstrap;
1897
1898	moea_pvo_enter_calls++;
1899	first = 0;
1900	bootstrap = 0;
1901
1902	/*
1903	 * Compute the PTE Group index.
1904	 */
1905	va &= ~ADDR_POFF;
1906	sr = va_to_sr(pm->pm_sr, va);
1907	ptegidx = va_to_pteg(sr, va);
1908
1909	/*
1910	 * Remove any existing mapping for this page.  Reuse the pvo entry if
1911	 * there is a mapping.
1912	 */
1913	mtx_lock(&moea_table_mutex);
1914	LIST_FOREACH(pvo, &moea_pvo_table[ptegidx], pvo_olink) {
1915		if (pvo->pvo_pmap == pm && PVO_VADDR(pvo) == va) {
1916			if ((pvo->pvo_pte.pte_lo & PTE_RPGN) == pa &&
1917			    (pvo->pvo_pte.pte_lo & PTE_PP) ==
1918			    (pte_lo & PTE_PP)) {
1919				mtx_unlock(&moea_table_mutex);
1920				return (0);
1921			}
1922			moea_pvo_remove(pvo, -1);
1923			break;
1924		}
1925	}
1926
1927	/*
1928	 * If we aren't overwriting a mapping, try to allocate.
1929	 */
1930	if (moea_initialized) {
1931		pvo = uma_zalloc(zone, M_NOWAIT);
1932	} else {
1933		if (moea_bpvo_pool_index >= BPVO_POOL_SIZE) {
1934			panic("moea_enter: bpvo pool exhausted, %d, %d, %d",
1935			      moea_bpvo_pool_index, BPVO_POOL_SIZE,
1936			      BPVO_POOL_SIZE * sizeof(struct pvo_entry));
1937		}
1938		pvo = &moea_bpvo_pool[moea_bpvo_pool_index];
1939		moea_bpvo_pool_index++;
1940		bootstrap = 1;
1941	}
1942
1943	if (pvo == NULL) {
1944		mtx_unlock(&moea_table_mutex);
1945		return (ENOMEM);
1946	}
1947
1948	moea_pvo_entries++;
1949	pvo->pvo_vaddr = va;
1950	pvo->pvo_pmap = pm;
1951	LIST_INSERT_HEAD(&moea_pvo_table[ptegidx], pvo, pvo_olink);
1952	pvo->pvo_vaddr &= ~ADDR_POFF;
1953	if (flags & VM_PROT_EXECUTE)
1954		pvo->pvo_vaddr |= PVO_EXECUTABLE;
1955	if (flags & PVO_WIRED)
1956		pvo->pvo_vaddr |= PVO_WIRED;
1957	if (pvo_head != &moea_pvo_kunmanaged)
1958		pvo->pvo_vaddr |= PVO_MANAGED;
1959	if (bootstrap)
1960		pvo->pvo_vaddr |= PVO_BOOTSTRAP;
1961	if (flags & PVO_FAKE)
1962		pvo->pvo_vaddr |= PVO_FAKE;
1963
1964	moea_pte_create(&pvo->pvo_pte, sr, va, pa | pte_lo);
1965
1966	/*
1967	 * Remember if the list was empty and therefore will be the first
1968	 * item.
1969	 */
1970	if (LIST_FIRST(pvo_head) == NULL)
1971		first = 1;
1972	LIST_INSERT_HEAD(pvo_head, pvo, pvo_vlink);
1973
1974	if (pvo->pvo_pte.pte_lo & PVO_WIRED)
1975		pm->pm_stats.wired_count++;
1976	pm->pm_stats.resident_count++;
1977
1978	/*
1979	 * We hope this succeeds but it isn't required.
1980	 */
1981	i = moea_pte_insert(ptegidx, &pvo->pvo_pte);
1982	if (i >= 0) {
1983		PVO_PTEGIDX_SET(pvo, i);
1984	} else {
1985		panic("moea_pvo_enter: overflow");
1986		moea_pte_overflow++;
1987	}
1988	mtx_unlock(&moea_table_mutex);
1989
1990	return (first ? ENOENT : 0);
1991}
1992
1993static void
1994moea_pvo_remove(struct pvo_entry *pvo, int pteidx)
1995{
1996	struct	pte *pt;
1997
1998	/*
1999	 * If there is an active pte entry, we need to deactivate it (and
2000	 * save the ref & cfg bits).
2001	 */
2002	pt = moea_pvo_to_pte(pvo, pteidx);
2003	if (pt != NULL) {
2004		moea_pte_unset(pt, &pvo->pvo_pte, pvo->pvo_vaddr);
2005		PVO_PTEGIDX_CLR(pvo);
2006	} else {
2007		moea_pte_overflow--;
2008	}
2009
2010	/*
2011	 * Update our statistics.
2012	 */
2013	pvo->pvo_pmap->pm_stats.resident_count--;
2014	if (pvo->pvo_pte.pte_lo & PVO_WIRED)
2015		pvo->pvo_pmap->pm_stats.wired_count--;
2016
2017	/*
2018	 * Save the REF/CHG bits into their cache if the page is managed.
2019	 */
2020	if ((pvo->pvo_vaddr & (PVO_MANAGED|PVO_FAKE)) == PVO_MANAGED) {
2021		struct	vm_page *pg;
2022
2023		pg = PHYS_TO_VM_PAGE(pvo->pvo_pte.pte_lo & PTE_RPGN);
2024		if (pg != NULL) {
2025			moea_attr_save(pg, pvo->pvo_pte.pte_lo &
2026			    (PTE_REF | PTE_CHG));
2027		}
2028	}
2029
2030	/*
2031	 * Remove this PVO from the PV list.
2032	 */
2033	LIST_REMOVE(pvo, pvo_vlink);
2034
2035	/*
2036	 * Remove this from the overflow list and return it to the pool
2037	 * if we aren't going to reuse it.
2038	 */
2039	LIST_REMOVE(pvo, pvo_olink);
2040	if (!(pvo->pvo_vaddr & PVO_BOOTSTRAP))
2041		uma_zfree(pvo->pvo_vaddr & PVO_MANAGED ? moea_mpvo_zone :
2042		    moea_upvo_zone, pvo);
2043	moea_pvo_entries--;
2044	moea_pvo_remove_calls++;
2045}
2046
2047static __inline int
2048moea_pvo_pte_index(const struct pvo_entry *pvo, int ptegidx)
2049{
2050	int	pteidx;
2051
2052	/*
2053	 * We can find the actual pte entry without searching by grabbing
2054	 * the PTEG index from 3 unused bits in pte_lo[11:9] and by
2055	 * noticing the HID bit.
2056	 */
2057	pteidx = ptegidx * 8 + PVO_PTEGIDX_GET(pvo);
2058	if (pvo->pvo_pte.pte_hi & PTE_HID)
2059		pteidx ^= moea_pteg_mask * 8;
2060
2061	return (pteidx);
2062}
2063
2064static struct pvo_entry *
2065moea_pvo_find_va(pmap_t pm, vm_offset_t va, int *pteidx_p)
2066{
2067	struct	pvo_entry *pvo;
2068	int	ptegidx;
2069	u_int	sr;
2070
2071	va &= ~ADDR_POFF;
2072	sr = va_to_sr(pm->pm_sr, va);
2073	ptegidx = va_to_pteg(sr, va);
2074
2075	mtx_lock(&moea_table_mutex);
2076	LIST_FOREACH(pvo, &moea_pvo_table[ptegidx], pvo_olink) {
2077		if (pvo->pvo_pmap == pm && PVO_VADDR(pvo) == va) {
2078			if (pteidx_p)
2079				*pteidx_p = moea_pvo_pte_index(pvo, ptegidx);
2080			break;
2081		}
2082	}
2083	mtx_unlock(&moea_table_mutex);
2084
2085	return (pvo);
2086}
2087
2088static struct pte *
2089moea_pvo_to_pte(const struct pvo_entry *pvo, int pteidx)
2090{
2091	struct	pte *pt;
2092
2093	/*
2094	 * If we haven't been supplied the ptegidx, calculate it.
2095	 */
2096	if (pteidx == -1) {
2097		int	ptegidx;
2098		u_int	sr;
2099
2100		sr = va_to_sr(pvo->pvo_pmap->pm_sr, pvo->pvo_vaddr);
2101		ptegidx = va_to_pteg(sr, pvo->pvo_vaddr);
2102		pteidx = moea_pvo_pte_index(pvo, ptegidx);
2103	}
2104
2105	pt = &moea_pteg_table[pteidx >> 3].pt[pteidx & 7];
2106
2107	if ((pvo->pvo_pte.pte_hi & PTE_VALID) && !PVO_PTEGIDX_ISSET(pvo)) {
2108		panic("moea_pvo_to_pte: pvo %p has valid pte in pvo but no "
2109		    "valid pte index", pvo);
2110	}
2111
2112	if ((pvo->pvo_pte.pte_hi & PTE_VALID) == 0 && PVO_PTEGIDX_ISSET(pvo)) {
2113		panic("moea_pvo_to_pte: pvo %p has valid pte index in pvo "
2114		    "pvo but no valid pte", pvo);
2115	}
2116
2117	if ((pt->pte_hi ^ (pvo->pvo_pte.pte_hi & ~PTE_VALID)) == PTE_VALID) {
2118		if ((pvo->pvo_pte.pte_hi & PTE_VALID) == 0) {
2119			panic("moea_pvo_to_pte: pvo %p has valid pte in "
2120			    "moea_pteg_table %p but invalid in pvo", pvo, pt);
2121		}
2122
2123		if (((pt->pte_lo ^ pvo->pvo_pte.pte_lo) & ~(PTE_CHG|PTE_REF))
2124		    != 0) {
2125			panic("moea_pvo_to_pte: pvo %p pte does not match "
2126			    "pte %p in moea_pteg_table", pvo, pt);
2127		}
2128
2129		return (pt);
2130	}
2131
2132	if (pvo->pvo_pte.pte_hi & PTE_VALID) {
2133		panic("moea_pvo_to_pte: pvo %p has invalid pte %p in "
2134		    "moea_pteg_table but valid in pvo", pvo, pt);
2135	}
2136
2137	return (NULL);
2138}
2139
2140/*
2141 * XXX: THIS STUFF SHOULD BE IN pte.c?
2142 */
2143int
2144moea_pte_spill(vm_offset_t addr)
2145{
2146	struct	pvo_entry *source_pvo, *victim_pvo;
2147	struct	pvo_entry *pvo;
2148	int	ptegidx, i, j;
2149	u_int	sr;
2150	struct	pteg *pteg;
2151	struct	pte *pt;
2152
2153	moea_pte_spills++;
2154
2155	sr = mfsrin(addr);
2156	ptegidx = va_to_pteg(sr, addr);
2157
2158	/*
2159	 * Have to substitute some entry.  Use the primary hash for this.
2160	 * Use low bits of timebase as random generator.
2161	 */
2162	pteg = &moea_pteg_table[ptegidx];
2163	mtx_lock(&moea_table_mutex);
2164	__asm __volatile("mftb %0" : "=r"(i));
2165	i &= 7;
2166	pt = &pteg->pt[i];
2167
2168	source_pvo = NULL;
2169	victim_pvo = NULL;
2170	LIST_FOREACH(pvo, &moea_pvo_table[ptegidx], pvo_olink) {
2171		/*
2172		 * We need to find a pvo entry for this address.
2173		 */
2174		MOEA_PVO_CHECK(pvo);
2175		if (source_pvo == NULL &&
2176		    moea_pte_match(&pvo->pvo_pte, sr, addr,
2177		    pvo->pvo_pte.pte_hi & PTE_HID)) {
2178			/*
2179			 * Now found an entry to be spilled into the pteg.
2180			 * The PTE is now valid, so we know it's active.
2181			 */
2182			j = moea_pte_insert(ptegidx, &pvo->pvo_pte);
2183
2184			if (j >= 0) {
2185				PVO_PTEGIDX_SET(pvo, j);
2186				moea_pte_overflow--;
2187				MOEA_PVO_CHECK(pvo);
2188				mtx_unlock(&moea_table_mutex);
2189				return (1);
2190			}
2191
2192			source_pvo = pvo;
2193
2194			if (victim_pvo != NULL)
2195				break;
2196		}
2197
2198		/*
2199		 * We also need the pvo entry of the victim we are replacing
2200		 * so save the R & C bits of the PTE.
2201		 */
2202		if ((pt->pte_hi & PTE_HID) == 0 && victim_pvo == NULL &&
2203		    moea_pte_compare(pt, &pvo->pvo_pte)) {
2204			victim_pvo = pvo;
2205			if (source_pvo != NULL)
2206				break;
2207		}
2208	}
2209
2210	if (source_pvo == NULL) {
2211		mtx_unlock(&moea_table_mutex);
2212		return (0);
2213	}
2214
2215	if (victim_pvo == NULL) {
2216		if ((pt->pte_hi & PTE_HID) == 0)
2217			panic("moea_pte_spill: victim p-pte (%p) has no pvo"
2218			    "entry", pt);
2219
2220		/*
2221		 * If this is a secondary PTE, we need to search it's primary
2222		 * pvo bucket for the matching PVO.
2223		 */
2224		LIST_FOREACH(pvo, &moea_pvo_table[ptegidx ^ moea_pteg_mask],
2225		    pvo_olink) {
2226			MOEA_PVO_CHECK(pvo);
2227			/*
2228			 * We also need the pvo entry of the victim we are
2229			 * replacing so save the R & C bits of the PTE.
2230			 */
2231			if (moea_pte_compare(pt, &pvo->pvo_pte)) {
2232				victim_pvo = pvo;
2233				break;
2234			}
2235		}
2236
2237		if (victim_pvo == NULL)
2238			panic("moea_pte_spill: victim s-pte (%p) has no pvo"
2239			    "entry", pt);
2240	}
2241
2242	/*
2243	 * We are invalidating the TLB entry for the EA we are replacing even
2244	 * though it's valid.  If we don't, we lose any ref/chg bit changes
2245	 * contained in the TLB entry.
2246	 */
2247	source_pvo->pvo_pte.pte_hi &= ~PTE_HID;
2248
2249	moea_pte_unset(pt, &victim_pvo->pvo_pte, victim_pvo->pvo_vaddr);
2250	moea_pte_set(pt, &source_pvo->pvo_pte);
2251
2252	PVO_PTEGIDX_CLR(victim_pvo);
2253	PVO_PTEGIDX_SET(source_pvo, i);
2254	moea_pte_replacements++;
2255
2256	MOEA_PVO_CHECK(victim_pvo);
2257	MOEA_PVO_CHECK(source_pvo);
2258
2259	mtx_unlock(&moea_table_mutex);
2260	return (1);
2261}
2262
2263static int
2264moea_pte_insert(u_int ptegidx, struct pte *pvo_pt)
2265{
2266	struct	pte *pt;
2267	int	i;
2268
2269	/*
2270	 * First try primary hash.
2271	 */
2272	for (pt = moea_pteg_table[ptegidx].pt, i = 0; i < 8; i++, pt++) {
2273		if ((pt->pte_hi & PTE_VALID) == 0) {
2274			pvo_pt->pte_hi &= ~PTE_HID;
2275			moea_pte_set(pt, pvo_pt);
2276			return (i);
2277		}
2278	}
2279
2280	/*
2281	 * Now try secondary hash.
2282	 */
2283	ptegidx ^= moea_pteg_mask;
2284	ptegidx++;
2285	for (pt = moea_pteg_table[ptegidx].pt, i = 0; i < 8; i++, pt++) {
2286		if ((pt->pte_hi & PTE_VALID) == 0) {
2287			pvo_pt->pte_hi |= PTE_HID;
2288			moea_pte_set(pt, pvo_pt);
2289			return (i);
2290		}
2291	}
2292
2293	panic("moea_pte_insert: overflow");
2294	return (-1);
2295}
2296
2297static boolean_t
2298moea_query_bit(vm_page_t m, int ptebit)
2299{
2300	struct	pvo_entry *pvo;
2301	struct	pte *pt;
2302
2303#if 0
2304	if (moea_attr_fetch(m) & ptebit)
2305		return (TRUE);
2306#endif
2307
2308	LIST_FOREACH(pvo, vm_page_to_pvoh(m), pvo_vlink) {
2309		MOEA_PVO_CHECK(pvo);	/* sanity check */
2310
2311		/*
2312		 * See if we saved the bit off.  If so, cache it and return
2313		 * success.
2314		 */
2315		if (pvo->pvo_pte.pte_lo & ptebit) {
2316			moea_attr_save(m, ptebit);
2317			MOEA_PVO_CHECK(pvo);	/* sanity check */
2318			return (TRUE);
2319		}
2320	}
2321
2322	/*
2323	 * No luck, now go through the hard part of looking at the PTEs
2324	 * themselves.  Sync so that any pending REF/CHG bits are flushed to
2325	 * the PTEs.
2326	 */
2327	SYNC();
2328	LIST_FOREACH(pvo, vm_page_to_pvoh(m), pvo_vlink) {
2329		MOEA_PVO_CHECK(pvo);	/* sanity check */
2330
2331		/*
2332		 * See if this pvo has a valid PTE.  if so, fetch the
2333		 * REF/CHG bits from the valid PTE.  If the appropriate
2334		 * ptebit is set, cache it and return success.
2335		 */
2336		pt = moea_pvo_to_pte(pvo, -1);
2337		if (pt != NULL) {
2338			moea_pte_synch(pt, &pvo->pvo_pte);
2339			if (pvo->pvo_pte.pte_lo & ptebit) {
2340				moea_attr_save(m, ptebit);
2341				MOEA_PVO_CHECK(pvo);	/* sanity check */
2342				return (TRUE);
2343			}
2344		}
2345	}
2346
2347	return (FALSE);
2348}
2349
2350static u_int
2351moea_clear_bit(vm_page_t m, int ptebit, int *origbit)
2352{
2353	u_int	count;
2354	struct	pvo_entry *pvo;
2355	struct	pte *pt;
2356	int	rv;
2357
2358	/*
2359	 * Clear the cached value.
2360	 */
2361	rv = moea_attr_fetch(m);
2362	moea_attr_clear(m, ptebit);
2363
2364	/*
2365	 * Sync so that any pending REF/CHG bits are flushed to the PTEs (so
2366	 * we can reset the right ones).  note that since the pvo entries and
2367	 * list heads are accessed via BAT0 and are never placed in the page
2368	 * table, we don't have to worry about further accesses setting the
2369	 * REF/CHG bits.
2370	 */
2371	SYNC();
2372
2373	/*
2374	 * For each pvo entry, clear the pvo's ptebit.  If this pvo has a
2375	 * valid pte clear the ptebit from the valid pte.
2376	 */
2377	count = 0;
2378	LIST_FOREACH(pvo, vm_page_to_pvoh(m), pvo_vlink) {
2379		MOEA_PVO_CHECK(pvo);	/* sanity check */
2380		pt = moea_pvo_to_pte(pvo, -1);
2381		if (pt != NULL) {
2382			moea_pte_synch(pt, &pvo->pvo_pte);
2383			if (pvo->pvo_pte.pte_lo & ptebit) {
2384				count++;
2385				moea_pte_clear(pt, PVO_VADDR(pvo), ptebit);
2386			}
2387		}
2388		rv |= pvo->pvo_pte.pte_lo;
2389		pvo->pvo_pte.pte_lo &= ~ptebit;
2390		MOEA_PVO_CHECK(pvo);	/* sanity check */
2391	}
2392
2393	if (origbit != NULL) {
2394		*origbit = rv;
2395	}
2396
2397	return (count);
2398}
2399
2400/*
2401 * Return true if the physical range is encompassed by the battable[idx]
2402 */
2403static int
2404moea_bat_mapped(int idx, vm_offset_t pa, vm_size_t size)
2405{
2406	u_int prot;
2407	u_int32_t start;
2408	u_int32_t end;
2409	u_int32_t bat_ble;
2410
2411	/*
2412	 * Return immediately if not a valid mapping
2413	 */
2414	if (!battable[idx].batu & BAT_Vs)
2415		return (EINVAL);
2416
2417	/*
2418	 * The BAT entry must be cache-inhibited, guarded, and r/w
2419	 * so it can function as an i/o page
2420	 */
2421	prot = battable[idx].batl & (BAT_I|BAT_G|BAT_PP_RW);
2422	if (prot != (BAT_I|BAT_G|BAT_PP_RW))
2423		return (EPERM);
2424
2425	/*
2426	 * The address should be within the BAT range. Assume that the
2427	 * start address in the BAT has the correct alignment (thus
2428	 * not requiring masking)
2429	 */
2430	start = battable[idx].batl & BAT_PBS;
2431	bat_ble = (battable[idx].batu & ~(BAT_EBS)) | 0x03;
2432	end = start | (bat_ble << 15) | 0x7fff;
2433
2434	if ((pa < start) || ((pa + size) > end))
2435		return (ERANGE);
2436
2437	return (0);
2438}
2439
2440boolean_t
2441moea_dev_direct_mapped(mmu_t mmu, vm_offset_t pa, vm_size_t size)
2442{
2443	int i;
2444
2445	/*
2446	 * This currently does not work for entries that
2447	 * overlap 256M BAT segments.
2448	 */
2449
2450	for(i = 0; i < 16; i++)
2451		if (moea_bat_mapped(i, pa, size) == 0)
2452			return (0);
2453
2454	return (EFAULT);
2455}
2456
2457/*
2458 * Map a set of physical memory pages into the kernel virtual
2459 * address space. Return a pointer to where it is mapped. This
2460 * routine is intended to be used for mapping device memory,
2461 * NOT real memory.
2462 */
2463void *
2464moea_mapdev(mmu_t mmu, vm_offset_t pa, vm_size_t size)
2465{
2466	vm_offset_t va, tmpva, ppa, offset;
2467	int i;
2468
2469	ppa = trunc_page(pa);
2470	offset = pa & PAGE_MASK;
2471	size = roundup(offset + size, PAGE_SIZE);
2472
2473	GIANT_REQUIRED;
2474
2475	/*
2476	 * If the physical address lies within a valid BAT table entry,
2477	 * return the 1:1 mapping. This currently doesn't work
2478	 * for regions that overlap 256M BAT segments.
2479	 */
2480	for (i = 0; i < 16; i++) {
2481		if (moea_bat_mapped(i, pa, size) == 0)
2482			return ((void *) pa);
2483	}
2484
2485	va = kmem_alloc_nofault(kernel_map, size);
2486	if (!va)
2487		panic("moea_mapdev: Couldn't alloc kernel virtual memory");
2488
2489	for (tmpva = va; size > 0;) {
2490		moea_kenter(mmu, tmpva, ppa);
2491		TLBIE(tmpva); /* XXX or should it be invalidate-all ? */
2492		size -= PAGE_SIZE;
2493		tmpva += PAGE_SIZE;
2494		ppa += PAGE_SIZE;
2495	}
2496
2497	return ((void *)(va + offset));
2498}
2499
2500void
2501moea_unmapdev(mmu_t mmu, vm_offset_t va, vm_size_t size)
2502{
2503	vm_offset_t base, offset;
2504
2505	/*
2506	 * If this is outside kernel virtual space, then it's a
2507	 * battable entry and doesn't require unmapping
2508	 */
2509	if ((va >= VM_MIN_KERNEL_ADDRESS) && (va <= VM_MAX_KERNEL_ADDRESS)) {
2510		base = trunc_page(va);
2511		offset = va & PAGE_MASK;
2512		size = roundup(offset + size, PAGE_SIZE);
2513		kmem_free(kernel_map, base, size);
2514	}
2515}
2516